PT-2026-23032

Name of the Vulnerable Software and Affected Versions @opennextjs/cloudflare affected versions not specified Description A Server-Side Request Forgery SSRF issue exists in the @opennextjs/cloudflare package. This is due to a path normalization bypass in the /cdn-cgi/image/ handler. Specifically,...

📄 Next.js 15.2.3 Middleware Authorization Bypass

This Python script checks whether a website built with Next.js is vulnerable to CVE‑2025‑29927, a middleware authorization bypass flaw triggered by the request header:x-middleware-subrequest...

Exploit for CVE-2025-66478

Vulnerable Mall Next.js Red/Blue Team Training Target Vul...

@adenta/cms (>=0.0.6, <=1.1.1-0), @contentql/core (>=0.1.2, <=0.3.5) +16 more potentially affected by CVE-2026-25544 via @payloadcms/next (>=3.0.0-beta.48, <=3.72.0-internal.3e70d4c)

@payloadcms/next NPM version =3.0.0-beta.48, =0.0.6, =0.1.2, =1.0.2, =0.1.0, =3.2.0, =0.2.0, =1.0.54, =0.1.0, =0.1.4, =1.0.0, =0.0.9-alpha.5, =3.0.0-beta.3, =1.53.40, =1.53.45 and more Source cves: CVE-2026-25544 Source advisory: SNYK:JS-PAYLOADCMSNEXT-15240192...

9remote (>=0.1.0, <=0.1.8), @alecpapierniak/mcp-manager (>=0.1.0, <=0.1.2) +118 more potentially affected by unknown CVE via next (>=16.1.0, <=16.1.4)

next NPM version =16.1.0, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.1.0, =0.1.1, =0.1.1, =0.1.1, =0.1.0, =0.0.1, =1.0.8, =0.3.0, =0.4.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-H25M-26QC-WCJF...

Drupal Next.js security vulnerabilities

Drupal Next.js is a module within the Drupal community that enables a deep integration between Drupal and Next.js. Versions of Drupal Next.js prior to 1.6.4 and 2.0.1 contained security vulnerabilities. These vulnerabilities were due to overly lax cross-domain security policies, which could lead ...

CVE-2025-59472

A denial of service vulnerability exists in Next.js versions with Partial Prerendering PPR enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the Next-Resume: 1 header and processes attacker-controlled postponed state data. Two closely related...

CVE-2025-59472

CVE-2025-59472 concerns Next.js with Partial Prerendering (PPR) enabled in minimal mode. The vulnerability stems from the PPR resume endpoint accepting unauthenticated POSTs (Next-Resume: 1) and processing attacker-controlled data, causing memory exhaustion via two vectors: 1) Unbounded request b...

CVE-2025-59472

A denial of service vulnerability exists in Next.js versions with Partial Prerendering PPR enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the Next-Resume: 1 header and processes attacker-controlled postponed state data. Two closely related...

47th (0.1.0), @0xchain/auth (>=0.0.1, <=1.1.0-beta.7) +210 more potentially affected by CVE-2025-55184 +1 more via next (>=15.5.0, <=15.5.9)

next NPM version =15.5.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2025-55184, CVE-2026-23864 Source advisory: SNYK:JS-NEXT-15921797...

Exploit for Improper Authorization in Vercel Next.Js

PoC: CVE-2025-29927 - Next.js Middleware Bypass This reposito...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell PoC This repository provides a minimal intentiona...

OAuth Parameter Injection

Auth0 Next.js is vulnerable to OAuth Parameter Injection. The vulnerability is due to insufficient validation of the returnTo parameter, where attacker-controlled input can inject unintended OAuth query parameters into the authorization request, potentially resulting in tokens being issued with...

Exploit for Deserialization of Untrusted Data in Facebook React

Affected Versions |Component|Recommended Installation Version...

react2shell-poc-demo

!CAUTION THIS PROJECT IS USED FOR DEMONSTRATION PURPOSES O...

Exploit for Deserialization of Untrusted Data in Facebook React

🛠️ CVE-2025-55182-POC-NEXTJS - Simple Proof of Concept for Nex...

Exploit for Deserialization of Untrusted Data in Facebook React

Node.js RCE Mitigation: DevOps as the Last Line of Defense Th...

@storybook/angular (>=10.0.0-beta.0, <=10.1.9), @storybook/ember (>=10.0.0-beta.0, <=10.1.9) +3 more potentially affected by CVE-2025-68429 via @storybook/builder-webpack5 (>=10.0.0, <=10.1.9)

@storybook/builder-webpack5 NPM version =10.0.0, =10.0.0-beta.0, =10.0.0-beta.0, =10.0.0-beta.0, =10.0.0-beta.0, =10.0.0-beta.0, =10.1.9 Source cves: CVE-2025-68429 Source advisory: SNYK:JS-STORYBOOKBUILDERWEBPACK5-14470054...

Exploit for Deserialization of Untrusted Data in Facebook React

🚨 NextRce — CVE-2025-55182 Next.js / React Server Components...

Security Bulletin: IBM Rhapsody Systems Engineering is using next-15.4.7.tgz which is vulnerable to CVE-2025-55182

Summary A security vulnerability was identified in the Next.js package used in IBM Rhapsody Systems Engineering. The issue is resolved by updating to a non-vulnerable patched version to ensure the continued security and reliability of the product. Vulnerability Details CVEID:CVE-2025-55182...